CVE alerts for
Java / JDK
CVEye scans every new CVE and notifies your team the moment Java / JDK is affected — before attackers can exploit it.
Recent Java / JDK CVEs
surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle.
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
Never miss a Java / JDK vulnerability
CVEye monitors Java / JDK and your entire stack 24/7, sending instant alerts via email, Slack, Discord, or webhook the moment a new CVE is published.
7-day free trial · No credit card required